I'm trying to index Salesforce Reports using this app, I've configured my account / token / password.
Here is what I see in my index:
I do not see any errors in the internal log while authenticating or consulting the report:
I'm not sure how to fix this or workaround to get my reports to Splunk (I rather not to download + upload or monitor).
Thanks a lot for your help!
I had the same problem where the report access was successful but the data ingested was all blank. The issue here is with the permission associated with the user which is used to interface splunk and salesforce. Ensure this user has System Admin Profile and check if you are not only able to access the report via the GUI but also to download the same. Mere accessing the report wont do.
Let me know if this helps.
I'm closing this question as the error as I needed to configure the account to the classic SalesForce view (not the summer '18); when the script was trying to export the data the report id I was using had some extra characters and the export had an option to export with format.
After I returned to the classic view and used the report id without the extra characters I was able to correctly index the report.
Hi, jbelloso, verify which type of URL you are using to configure the Salesforce SOQL, it needs to bemy.salesforce.com/XXXX rather than lightning/r/Report/XXXXXX as the last one add extra information that will not allow the query to run as expected.
If this doesn't help, please post the internal logs and the output of the index query.
I'm using the Salesforce Reports TA splunkbase /app/3567/
The App just request account, token and password -> I created an input with the Salesforce Report ID.
I cant upload the current options as "Answers" won't allow me.
I'm not trying to integrate the Splunk App with the Add on to monitor the Reports Access (Via Object), so, as the Add-On do not give me the option to select the Report ID
What's happening is, the TA is thinking the null values are in json format so its creating a new event for each null event. Can you confirm your other events are correctly linebreaking?
Here is the props.conf
ANNOTATE_PUNCT = 1
AUTO_KV_JSON = 1
BREAK_ONLY_BEFORE = None
BREAK_ONLY_BEFORE_DATE = 1
HEADER_MODE = None
KV_MODE = json
LEARN_MODEL = 1
LEARN_SOURCETYPE = 1
MUST_BREAK_AFTER = None
MUST_NOT_BREAK_AFTER = None
MUST_NOT_BREAK_BEFORE = None
SHOULD_LINEMERGE = 0
TRANSFORMS = None
category = REST API
detect_trailing_nulls = 0
disabled = 0
priority = None
pulldown_type = 1
sourcetype = None